This disclosure relates generally to sharing of user privileges or credentials, and particularly to tracking of commands and users who entered those commands in a multi-user operating system in which those users share a credential to access that multi-user operating system.